CVE-2026-107509: Memory exhaustion denial of service in SQL Expressions

Published Nov 11, 2026

Updated

A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).

Event History

Nov 11, 2026

CVE Published

via MITRE·03:02 PM

Data Sourced

via MITRE·03:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Grafana user with the Viewer role can exploit it. The attack requires no user interaction and can be performed remotely.

What capability does an attacker need to trigger the denial of service?

The attacker needs to submit a SQL Expression query that casts a value to a very large BINARY length. A single such query can cause unbounded memory allocation and crash Grafana.

What is the expected impact?

The stated impact is availability loss: Grafana can exhaust memory and crash. No confidentiality or integrity impact is indicated by the supplied severity vector.

CVE-2026-107509: Memory exhaustion denial of service in SQL Expressions

Event History

Frequently Asked Questions

Who can exploit this issue?

What capability does an attacker need to trigger the denial of service?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capability does an attacker need to trigger the denial of service?

What is the expected impact?